Castalong

Legal

Effective 13 June 2026 (version 2026-06-13). These documents form a binding agreement governing your use of Castalong. By using the service you agree to them.

Terms of Service

1. Who you are agreeing with

These Terms are a binding agreement between you and Castalong, a hosted service operated by a sole trader established in the Netherlands ("Castalong", "we", "us"), and the individual or organisation using the service ("you"). You can reach us at castalong@castalong.me.

2. The service

Castalong is a hosted online service at castalong.me that lets a streamer bring remote guests' camera, microphone, screen, window or game audio into OBS Studio over WebRTC. Guest media is relayed in real time through Castalong-operated infrastructure (including a LiveKit media server we run). Castalong does not store guest media by default. If a streamer uses the Record feature, Castalong stores a per-guest file for 24 hours so it can be downloaded, then deletes it automatically. If a streamer enables cloud export, finished recordings are also copied to a storage bucket the streamer controls; once in that bucket they are governed by the streamer's own storage, retention and policies, not Castalong's 24-hour schedule. We also provide a dashboard to manage rooms.

3. Accepting these Terms

You accept these Terms when you create an account, sign in with Twitch, tick the acceptance box at sign-up, join a room, use the API, or continue using Castalong after we have notified you of an update. We keep a record of your acceptance (account, version, and time).

4. Your account

  • Provide accurate account details and keep them current.
  • You are responsible for activity under your account and for keeping your password, API key, room links, PINs and Config URLs secret. Anyone holding a room's link (and PIN, if set) can join it.
  • Passwords are stored only as a salted bcrypt hash; we cannot retrieve them. Twitch sign-in is optional.
  • API keys must not be embedded in public clients or shared publicly.
  • You must be at least 16 years old to create an account.

5. Beta, free use and future paid plans

Castalong is currently provided free of charge during its beta. We may introduce paid plans later. Any prices, billing terms, renewal, taxes, cancellation and applicable consumer-withdrawal rights will be shown to you before you purchase; nothing here commits you to future payment.

6. Licence

Subject to these Terms, you get a personal, limited, revocable, non-transferable right to use Castalong. Access is licensed per seat (one named user account / one active OBS install syncing a Config URL); seats may not be shared by multiple people. The Castalong software is proprietary and built on the open-source components listed below.

7. Your content

You and your guests keep all rights in the media, audio, video, screen shares and room names you provide. You grant Castalong only the limited licence needed to relay, process, display, store (where you start a recording), secure, troubleshoot and delete that content in order to operate the service, comply with law and enforce these Terms. We do not sell your content and we do not use recordings for anything other than delivering the recording feature to you.

8. Recording and consent

This is your responsibility. If you enable recording, or invite guests into a room where recording may occur, you must give all legally required notices and obtain all required consents from your guests and other participants before recording. You must not record anyone unlawfully or deceptively. Any recording indicators Castalong shows do not replace your own legal obligations.

9. Acceptable use

You must comply with the Acceptable Use Policy. Breaching it is a breach of these Terms.

10. Availability and changes to the service

We may modify, suspend or discontinue features (including beta features) where reasonably necessary for security, maintenance, legal compliance, abuse prevention or product development. We will give reasonable notice of material changes where practical.

11. Suspension and termination

We may suspend or terminate access if you materially breach these Terms, create a security or abuse risk, infringe others' rights, use the service unlawfully, or (for future paid plans) fail to pay. Where practical and lawful we will give notice and a chance to fix the issue. You may stop using Castalong and delete your account and rooms at any time.

12. Disclaimer of warranties

To the maximum extent permitted by law, Castalong is provided on an "as is" and "as available" basis. We do not promise uninterrupted, error-free or loss-free operation, and we do not guarantee that it will meet every production, broadcast or recording requirement. Nothing in these Terms limits rights that cannot legally be limited, including mandatory consumer rights under applicable EU or national law.

13. Limitation of liability

To the maximum extent permitted by law, Castalong is not liable for indirect, incidental, special, consequential, punitive or lost-profit damages; lost streams, revenue, audience, goodwill or data; or damage caused by third-party platforms, networks, OBS, Twitch, your devices or internet connectivity. To the maximum extent permitted by law, our total liability for all claims relating to the service is limited to the greater of (a) the amount you paid us in the 12 months before the claim or (b) EUR 100. None of this excludes liability that cannot be excluded by law, including for death or personal injury, intent, gross negligence or fraud.

14. Indemnity

If you use Castalong for business or professional purposes, you will indemnify Castalong against third-party claims, damages, fines and reasonable costs arising from your unlawful recordings or content, your infringement of third-party rights, your breach of the Acceptable Use Policy or of data-protection obligations, or misuse of your API keys. This does not apply to consumers where prohibited by mandatory law.

15. Governing law and disputes

These Terms are governed by the law of the Netherlands. If you are a business user, disputes will be brought before the competent courts of the Netherlands. If you are a consumer in the EU/EEA, this does not remove your right to rely on the mandatory consumer-protection rules of, and to bring proceedings in, your country of residence.

16. Changes to these Terms

We may update these Terms. We will publish the updated version with a new effective date. For non-material changes, continuing to use Castalong after the effective date means you accept them. For material changes, and for any change to paid-plan terms, we will give reasonable advance notice (by email, in-app notice or a sign-in prompt) and the change takes effect only once you accept it, except where mandatory law requires otherwise.

17. Consumer rights and severability

If you are a consumer in the EU/EEA or another jurisdiction with mandatory consumer-protection law, nothing here excludes, restricts or waives rights that cannot legally be waived. If any term is unenforceable against you, the rest remains in effect.

Acceptable Use Policy

When using Castalong you must not:

  • record or surveil anyone unlawfully, or without the notices and consent the law requires;
  • harass, threaten, defame or exploit anyone, or transmit hateful content or any child sexual abuse material;
  • infringe anyone's copyright, trademark, privacy, publicity or confidentiality rights, or broadcast content you have no right to use;
  • distribute malware, attempt credential theft or phishing, or send spam;
  • probe, scan, attack, overload, reverse-engineer or disrupt our infrastructure, except for security testing we have authorised in writing;
  • abuse the media relays or generate excessive load, denial-of-service or bandwidth abuse;
  • bypass plan, seat or rate limits, resell access without authorisation, or share API keys; or
  • rely on Castalong for emergency, safety-critical, medical or legal-evidence purposes.

To protect the service, its users and third parties, we may remove content, disable recordings, rotate or revoke API keys, suspend rooms, or suspend or terminate accounts.

Privacy & GDPR notice

Data controller: Castalong, operated by a sole trader established in the Netherlands. For any privacy request or question, contact castalong@castalong.me.

Your audio and video are not recorded by default. They are relayed live between participants and discarded. The one exception is recording: if a streamer clicks Record, each guest is saved to a file, kept for 24 hours so it can be downloaded, then deleted. Nothing is recorded unless someone in the room starts it.

What we process, why, on what basis, and for how long

DataPurposeLawful basisRetention
Account emailCreate the account, sign in, send service notices, supportPerformance of a contract; legitimate interest in security/supportUntil you delete the account (then limited backup/legal retention)
Password (bcrypt hash)Authenticate youPerformance of a contractUntil reset or account deletion
Twitch ID / login (if you use Twitch sign-in)Optional single sign-onPerformance of a contract (the login method you chose)Until you disconnect or delete the account
Rooms, API keys, OBS installsRun your showsPerformance of a contractUntil you delete them
Live camera/mic/screen/game mediaRelay it between participants over WebRTCProcessed on the streamer's instruction (we act as processor; the streamer is the controller)Not stored; relayed live and discarded
Recordings (only if a streamer starts one)Give per-guest files to downloadOn the streamer's instruction (we act as processor); legitimate interest in secure storageDeleted automatically after 24 hours, or when you delete your account. Copies the streamer exports to their own cloud bucket are then under the streamer's control.
Connection metadata, IP addresses, server logsOperate the relay, diagnose problems, prevent abuse, securityLegitimate interest in service integrity, security and abuse preventionKept short-term and rotated; generally no longer than 90 days
Support emailsAnswer your requestPerformance of a contract or legitimate interestUp to 24 months
Session cookieKeep you signed inStrictly necessary (no consent required)Session / its expiry
Analytics events (self-hosted Umami)Count visits in aggregate, with no tracking cookies or profilesLegitimate interest in understanding usageAggregated; no cross-site tracking
Billing data (not collected yet; applies once paid plans launch)Take payment, invoice, meet tax dutiesPerformance of a contract; legal obligationAs required by Dutch tax law (currently 7 years)

Where short-term backups exist, deleted data is purged from them within 30 days. We may keep limited data longer only where needed to comply with the law or to establish, exercise or defend legal claims.

Your rights

You may ask us to access, correct, delete, restrict, port, or object to the processing of your personal data, and where we rely on consent you may withdraw it at any time without affecting earlier lawful processing. You can also export or delete your account data from your dashboard. To exercise any right, contact castalong@castalong.me; we may need to verify your identity. You have the right to lodge a complaint with your local supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

We do not sell personal data and we do not share it with third parties for their own marketing.

Controller and processor roles

Castalong is the controller for account management, authentication, security, abuse prevention, analytics, support, and operating the service.

For guest media and for streamer-initiated recordings, Castalong generally acts as a processor on behalf of the streamer (or their organisation) who creates the room, decides who to invite and what to capture, and chooses whether to record. That streamer is responsible for having a lawful basis and giving the required notices to guests. Castalong also processes limited media-related metadata as a controller where necessary for security, abuse prevention, service integrity, legal compliance and troubleshooting. We do not use guest media or recordings for any purpose other than delivering the service.

When we act as your processor we: act only on your instructions and as needed to provide the service; keep guest media and recordings confidential; protect them with appropriate technical and organisational measures; use only the sub-processors listed below; delete them on the stated schedule (recordings after 24 hours) or when you delete your account; and assist you, so far as reasonably possible, with data-subject requests and security matters relating to that data.

Sub-processors and infrastructure

We process and host data in the EU/EEA. We do not transfer personal data outside the EEA in the normal course of providing the service; if that ever changes, we will identify the provider and use a valid transfer mechanism (such as an adequacy decision or Standard Contractual Clauses).

ProviderRoleLocationData involved
HetznerHosting (servers)Germany / Finland (EU)The application, database, recordings and logs
TransIPDNS / domainNetherlands (EU)Domain and DNS-related operational data
Twitch (only if you use Twitch sign-in)OAuth identity providerPer TwitchYour Twitch user id and login, to sign you in

The LiveKit media server, the Umami analytics and the mail server are run by us on our own EU infrastructure, not by third-party vendors. If we add or change a sub-processor, we will update this section.

Cookies

Castalong uses a single, strictly necessary session cookie to keep you signed in and protect your account session. It is required to provide the service and cannot be turned off from within Castalong. We use no advertising or cross-site tracking cookies, and our self-hosted Umami analytics works without cookies — which is why you do not see a cookie banner.

Licensing

Castalong is licensed per seat: one seat per active OBS install (a machine syncing a Config URL). Your dashboard shows seats used against your limit. The Castalong software itself is proprietary; it is built on the open-source components below.

Open-source acknowledgements

Castalong is made possible by, and gratefully credits, these projects:

ProjectRoleLicence
LiveKitWebRTC SFU + Rust/JS SDKsApache-2.0
Caddy + caddy-dns/transipTLS / reverse proxyApache-2.0 / MIT
Go, golang.org/x/cryptoControl service + bcryptBSD-3-Clause
modernc.org/sqliteEmbedded databaseBSD-3-Clause
Rust + tokio, ureq, serde, futuresOBS pluginMIT / Apache-2.0
OBS Studio (libobs)Plugin hostGPL-2.0 (linked at runtime via published API)